Webhooks
Webhooks in the Settings area (Platform) — route /settings/webhooks.
Webhooks lives in the Settings area of the dashboard, under Platform.
At a glance#
| Dashboard route | /settings/webhooks |
| Area | Settings (settings) |
| Group | Platform |
| Platforms | Available for every app platform. |
What it does#
Webhooks push events from ScaleBun to a URL you control. You create an endpoint, subscribe it to the events you care about, send a test delivery, inspect the delivery history, and rotate its signing secret.
The signing secret is how your receiver knows a request came from us. Every delivery is signed with it, and verifying that signature is not optional — see below.
When to use it#
When you need ScaleBun to notify a system rather than a person. Integrations for Slack, Jira and the rest are already built; a webhook is for everything else — your own service, an internal tool, a workflow engine.
Workflow#
Verify the signature before you trust a payload
Your endpoint is a public URL. Without signature verification anyone who finds it can send you a fabricated event, and you will act on it.
Subscribe to specific events, not everything
Volume you do not need is volume you have to filter and pay to receive.
Send a test delivery
Confirms reachability and your signature check in one step, before real events depend on it.
Respond fast and process asynchronously
Acknowledge with a 2xx immediately and do the work afterwards. A slow endpoint gets treated as a failing one.
Permissions and prerequisites#
Requires an administrative role. Creation, deletion and secret rotation are recorded in the audit log.
Your endpoint must be publicly reachable over HTTPS.
Limits and edge cases#
Delivery is at-least-once. A retry can deliver the same event twice; your handler must be idempotent.
Order is not guaranteed. Do not build logic that depends on receiving events in sequence.
Rotating the secret invalidates the old one. Deploy the new secret to your receiver in the same change.
Redaction applies if you enable it. Webhook payloads can carry captured data — see Data privacy, where webhook redaction is a separate toggle.
Troubleshooting#
Deliveries stopped. Check for webhook.auto_disabled in the audit log, then your endpoint's availability.
Signature verification fails. Usually the secret was rotated and the receiver still has the old one, or the raw request body is being re-serialised before verification — sign against the bytes you received.
Duplicate processing. Expected under at-least-once delivery. Deduplicate on the event id.
Where the data comes from#
Served by
Integrations